lordievader/localrepo
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add dev-qt from an older version of the gentoo repo

Browse Source 
Qt5 has been removed, we restore it since we still use it.
This commit is contained in:
Olivier van der Toorn
2026-07-03 09:45:00 +02:00
parent 2247967dd3
commit d21535e7cb
586 changed files with 30139 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
dev-qt/qtsvg/files/qtsvg-6.10.3-CVE-2026-6210.patch Normal file
View File

@ -0,0 +1,43 @@
https://bugs.gentoo.org/974278
https://codereview.qt-project.org/c/qt/qtsvg/+/732200
--- a/src/svg/qsvgstructure.cpp
+++ b/src/svg/qsvgstructure.cpp
@@ -415,7 +415,8 @@
const auto markers = markersForNode(node);
for (auto &i : markers) {
- QSvgMarker *markNode = static_cast<QSvgMarker*>(node->document()->namedNode(i.markerId));
- if (!markNode)
+ QSvgNode *referencedNode = node->document()->namedNode(i.markerId);
+ if (!referencedNode || referencedNode->type() != QSvgNode::Marker)
continue;
+ QSvgMarker *markNode = static_cast<QSvgMarker *>(referencedNode);
p->save();
@@ -722,6 +723,7 @@
// Chrome seems to return the mask of the mask if a mask is set on the mask
if (this->hasMask()) {
- QSvgMask *maskNode = static_cast<QSvgMask*>(document()->namedNode(this->maskId()));
- if (maskNode) {
+ QSvgNode *referencedNode = document()->namedNode(this->maskId());
+ if (referencedNode && referencedNode->type() == QSvgNode::Mask) {
+ QSvgMask *maskNode = static_cast<QSvgMask *>(referencedNode);
QRectF boundsRect;
return maskNode->createMask(p, states, localRect, &boundsRect);
--- a/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp
+++ b/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp
@@ -1868,4 +1868,15 @@
QTest::newRow("excessive moveto in path") // id=406541912
<< R"(<svg><path stroke="#000" d="M- 7e8t9 ."/><marker id="c"/><use href=" c"/></svg>)"_ba;
+ // Bad-cast to QSvgMarker from QSvgLine -> Heap-buffer-overflow
+ QTest::newRow("line-as-marker") // id=496327371
+ << R"-(<svg><line x1="4" id="lledr" marker-end="url(#lledr)" stroke="#00f"/></svg>)-"_ba;
+ QTest::newRow("line-as-mask") // modeled after 496327371 to test similar problem, needs UBSAN
+ << R"-(<svg>
+ <defs>
+ <line x1="4" id="line"/>
+ <mask id="mask" width="2" height="2" mask="url(#line)"/>
+ </defs>
+ <rect width="2" height="2" mask="url(#mask)"/>
+ </svg>)-"_ba;
}